The present invention relates generally to an electronic control unit (ECU) for a vehicle such as a car and the like, and more particularly to an electronic control unit of a safety control system for a vehicle having simple structure and high reliability.
In the safety control system of a vehicle such as an antilock brake system (ABS) and the like, the electronic control unit (ECU) having one or more microcomputers therein is used. In the electronic control unit, results of operation including arithmetic operation by the microcomputers are used for controlling various actuators and the like, and thereby running performance, braking performance and the like are improved.
In such electronic control unit, when, for example, a microcomputer therein becomes out of order and outputs incorrect operation result or incorrect control data, there is a possibility that serious influence on an operation of the vehicle, such as abnormal driving, abnormal braking and the like occurs. Therefore, conventionally, the electronic control unit comprises a fail-safe mechanism for preventing occurrence of such abnormal control.
FIG. 5 schematically shows an example of a structure of a conventional electronic control unit. As shown in FIG. 5, the electronic control unit comprises a duplicate structure of a pair of microcomputers 51 and 52. An input signal 50 is commonly supplied to both of the microcomputers 51 and 52. The microcomputers 51 and 52 comprise watchdog pulse monitoring circuits 53 and 54, and mutual communication and monitoring circuits 55 and 56. Each of the watchdog pulse monitoring circuits 53 and 54 mutually monitors watchdog pulses outputted from the other microcomputer and decides if the watchdog pulses have a predetermined constant period, that is, if on-time and off-time of each watchdog pulse are respectively within predetermined time ranges. Thereby, each of the watchdog pulse monitoring circuits 53 and 54 monitors abnormal run of a CPU not shown in the drawing of the other microcomputer. Also, mutual communication and monitoring circuits 53 and 54 mutually send and receive the contents of random access memories (RAM""s) (not shown in the drawing) which are included in the microcomputers 51 and 52 and which store result of operation of CPU""s in the microcomputers 51 and 52, and compare the contents of the RAM""s mutually to detect abnormal condition of the microcomputers. Also, there is provided a comparing circuit 57 which compares operation results outputted from both microcomputers 51 and 52. When the operation results do not coincide, it is determined that there is any fault in operational function and the like of a processing system including the microcomputers 51 and 52, and the comparing circuit 57 outputs a fault signal indicating that there is a fault condition in the processing system. In response to the output of the fault signal, operation of the processing system is halted if necessary, thereby securing reliability.
FIG. 6 illustrates another example of a structure of a conventional electronic control unit. The electronic control unit shown in FIG. 6 comprises a microcomputer 61 and a fail-safe microcomputer, that is, a sub-processing unit, 62. The microcomputer 61 accepts an input signal 60, performs necessary processing operation on the input signal 60, and supplies the result of the processing operation as an output signal 65. The fail-safe microcomputer 62 accepts the input signal 60 and performs simple processing operation on the input signal 60. The output of the microcomputer 61 is supplied via a pre-driver 64 to one or more actuators and the like not shown in the drawing as a control signal. The fail-safe microcomputer 62 comprises an output monitoring circuit or block 63 which monitors the condition of the output signal 65 from the microcomputer 61. When the output monitoring circuit 63 detects abnormal condition of the output signal 65, the output monitoring circuit 63 controls the pre-driver 64 such that the driver output from the pre-driver 64 is disabled or turned off.
In Japanese patent laid-open publication No. 7-52784, an anti-skid controller is disclosed as a vehicle safety apparatus. The anti-skid controller disclosed in this publication has a structure in which a wheel speed operation value obtained by an operation of a main processor itself is compared with a wheel speed operation value from a sub-processor received via a data transferring means are compared with each other to decide if the anti-skid controller operates normally. However, the technical idea of this prior art structure is basically the same as that of the duplicated structure including a plurality of microcomputers shown in FIG. 5, FIG. 6 and the like.
Also, in an anti-skid controller disclosed in Japanese patent laid-open publication No. 7-40828, there are provided a plurality of processors. In this anti-skid controller, operation results of these plurality of processors are compared and, based on the result of the comparison, malfunction is detected. However, the technical idea of this prior art structure is also basically the same as that of the duplicated structure including a plurality of microcomputers shown in FIG. 5, FIG. 6 and the like.
In this way, in each of the conventional electronic control units mentioned above, a duplicated structure comprising two microcomputers is used and, therefore, it is difficult to decrease cost and circuit scale of the electronic control unit.
This is because, a duplicated microcomputer system having fail-safe function requires relatively high performance microcomputers. Therefore, usually, each of the microcomputers is constituted of a 16 bit or 8 bit microcomputer which is relatively expensive among various electronic components of the electronic control unit. As a result thereof, when the duplicated microcomputer system is constituted of such 16 bit or 8 bit microcomputers, cost and size of the electronic control unit itself are also greatly influenced by the microcomputers.
Recently, a method of diagnosis has been improved, and an electronic control unit is proposed in which the diagnosis is performed by using 4 bit microcomputer. For example, Japanese patent laid-open publication No. 7-17337 discloses an electronic control unit having such structure. In the electronic control unit disclosed in this publication, to detect abnormal condition of a processing system thereof, a main CPU is constituted of a 16 bit microcomputer and a sub CPU is constituted of an 8 bit microcomputer, thereby a structure of the electronic control unit is simplified. However, even in this structure, it is necessary to use two microcomputers and it is difficult to decrease cost and circuit scale of the electronic control unit.
Therefore, it is an object of the present invention to obviate the disadvantages of the conventional electronic control unit for a vehicle.
It is another object of the present invention to provide an electronic control unit for a vehicle which has high reliability but which has small circuit scale and is less expensive.
It is still another object of the present invention to provide an electronic control unit for a vehicle which has high reliability but which has simple structure and small size.
It is still another object of the present invention to provide an electronic control unit for a vehicle in which diagnosis of a microcomputer in the electronic control unit can be performed by using a simple and low cost structure.
It is still another object of the present invention to provide an electronic control unit for a vehicle which has simple structure and low cost, but which can realize equal reliability with that of the conventional system having duplicated microcomputers.
According to an aspect of the present invention, there is provided an electronic control unit which receives an input signal from outside and performs data processing on the input signal to produce an output signal, the electronic control unit comprising: a microcomputer including a first operating portion and a second operating portion both receiving the input signal commonly, and a self check portion for comparing operation result of the first operating portion and the second operating portion and outputting a signal indicating abnormal condition when the operation result do not coincide with each other; and a safety control means which switches an output signal thereof from an output signal of the microcomputer to a safe side signal when the signal indicating abnormal condition from the self check portion continues for a time equal to or longer than a predetermined time.
In this case, it is preferable that the self check portion monitors an output signal from the first operating portion and outputs a signal indicating abnormal condition when the first operating portion outputs abnormal output signal for a time equal to or longer than a predetermined time.
It is also preferable that the self check portion comprises: a comparing portion which compares operation result of the first operating portion and the second operating portion; a monitoring portion which monitors the output of the first operating portion; and an output portion which outputs a signal indicating abnormal condition when the monitoring portion indicates that the first operating portion outputs abnormal output signal value for a time equal to or longer than a predetermined time, or when the comparing portion indicates that an error rate of operation result between the first operating portion and the second operating portion is higher than or equal to a predetermined value.
It is further preferable that the safety control means comprises: a fail-safe unit which receives an output signal of the first operating portion as an input thereof; and a measuring unit which measures a duration the signal indicating abnormal condition is outputted from the output portion, and which, when the signal indicating abnormal condition is outputted from the output portion for a time equal to or longer than a predetermined time, outputs a switching control signal for switching an output signal of the fail-safe signal from an output of the microcomputer to a safe side output signal.
It is advantageous that both the first operating portion and the second operating portion receive an output signal from a common wheel speed sensor.
It is also advantageous that the electronic control unit further comprises a watchdog pulse monitoring circuit which monitors a watchdog pulse signal outputted from the microcomputer and which generates a reset signal from resetting the microcomputer when periods of the watchdog pulse signal become abnormal for a time equal to or longer than a predetermined time.
According to another aspect of the present invention, there is provided an electronic control unit for a vehicle which receives a sensor signal as an input signal and provides an output signal for controlling operation of the vehicle, the electronic control unit comprising: a microcomputer having a first operating portion and a second operating portion both receiving the input signal commonly, and a self check portion which compares operation result of the first operation portion and the second operating portion and outputs a signal indicating abnormal condition when the operation result do not coincide with each other; and a safety control means which switches an output signal thereof from an output signal of the microcomputer to a safe side signal when the signal indicating abnormal condition from the self check portion continues for a time equal to or longer than a predetermined time.
In this case, it is preferable that the self check portion monitors an output signal from the first operating portion and outputs the signal indicating abnormal condition when the first operating portion outputs abnormal outputs signal for a time equal to or longer than a predetermined time.
It is also preferable that the self check portion comprises: a comparing portion which compares operation result of the first operating portion and the second operating portion; a monitoring portion which monitors the output of the first operating portion; and an output portion which outputs a signal indicating abnormal condition when the monitoring portion indicates that the first operating portion outputs abnormal output signal value for a time equal to or longer than a predetermined time, or when the comparing portion indicates that an error rate of operation result between the first operating portion and the second operating portion is higher than or equal to a predetermined value.
It is further preferable that the safety control means comprises: a fail-safe unit which receives an output signal of the first operating portion as an input thereof; and a measuring unit which measures a duration the signal indicating abnormal condition is outputted from the output portion, and which, when the signal indicating abnormal condition is outputted from the output portion for a time equal to or longer than a predetermined time, outputs a switching control signal for switching an output signal of the fail-safe signal from an output of the microcomputer to a safe side output signal.
It is advantageous that the electronic control unit further comprises a watchdog pulse monitoring circuit which monitors a watchdog pulse signal outputted from the microcomputer and which generates a reset signal for resetting the microcomputer when periods of the watchdog pulse signal become abnormal for a time equal to or longer than a predetermined time.
According to still another aspect of the present invention, there is provided an electronic control unit in a safety control system for a vehicle comprising: (a) a microcomputer having: a first operating portion and a second operating portion both receiving a signal inputted from a common sensor of the vehicle; a comparing portion which compares operation result of the first operating portion and the second operating portion; a monitoring portion which monitors an output signal outputted to an output port from the first operating portion and which outputs a signal indicating abnormal condition when the output signal from the output port has abnormal value for a time equal to or longer than a predetermined time; and an output portion which outputs a signal indicating abnormal condition when the monitoring portion outputs the signal indicating abnormal condition, or when the comparing portion indicates that an error rate of operation result between the first operating portion and the second operating portion is higher than or equal to a predetermined value; (b) a measuring unit which monitors the signal indicating abnormal condition outputted from the output portion of the microcomputer, and which, when the signal indicating abnormal condition is outputted from the output portion for a time equal to or longer than a predetermined time, outputs a switching control signal; and (c) a fail-safe unit which receives an output signal of the output port of the microcomputer as an input thereof, and which, when the switching control signal is outputted from the measuring unit, switches an output signal of the fail-safe unit from an output of the microcomputer to a safe side output signal.
In this case, it is preferable that the monitoring portion comprises a counter for counting a time during which an output signal from the output port has an abnormal value, the monitoring portion outputting a signal indicating abnormal condition when a count value of the counter has exceeded a predetermined value.
It is also preferable that the measuring unit comprises a counter for counting a time during which a signal indicating abnormal condition outputted from the output portion of the microcomputer is active, the measuring unit outputting the switching control signal when a count value of the counter has reached a value equal to or larger than a predetermined value.
It is further preferable that the electronic control unit further comprises a watchdog pulse monitoring circuit which monitors a watchdog pulse signal outputted from the microcomputer and which generates a reset signal for resetting the microcomputer when periods of the watchdog pulse signal become abnormal for a time equal to or longer than a predetermined time.
It is advantageous that the sensor comprises a wheel speed sensor, an output signal of the wheel speed sensor being wave-shaped by a wave-shaping circuit and inputted to the microcomputer, wherein the first operating portion comprises a first pulse width measuring portion which receives the wave-shaped output signal from the wheel speed sensor, and a first arithmetic logic unit for calculating a wheel speed from an output of the first pulse width measuring portion, and wherein the second operating portion comprises a second pulse width measuring portion which receives the wave-shaped output signal from the wheel speed sensor, and a second arithmetic logic unit for calculating a wheel speed from an output of the second pulse width measuring portion.